@@ -422,7 +422,7 @@ Resources:
422422 Fn::GetAtt :
423423 - CodeBuildRoleE9A44575
424424 - Arn
425- ContentHash : " 1768809143448 "
425+ ContentHash : " 1774370017491 "
426426 ProjectName :
427427 Ref : CodeBuildProjectA0FF5539
428428 ServiceToken :
@@ -511,7 +511,7 @@ Resources:
511511 EnvironmentVariables :
512512 - Name : TEMPLATE_TYPE
513513 Type : PLAINTEXT
514- Value : java-on-aws-immersion-day
514+ Value : java-on-aws
515515 - Name : GIT_BRANCH
516516 Type : PLAINTEXT
517517 Value : main
@@ -543,6 +543,8 @@ Resources:
543543 # Resolution for when creating the first service in the account
544544 aws iam create-service-linked-role --aws-service-name ecs.amazonaws.com 2>/dev/null || true
545545 aws iam create-service-linked-role --aws-service-name elasticloadbalancing.amazonaws.com 2>/dev/null || true
546+ aws iam create-service-linked-role --aws-service-name network.bedrock-agentcore.amazonaws.com 2>/dev/null || true
547+ aws iam create-service-linked-role --aws-service-name runtime-identity.bedrock-agentcore.amazonaws.com 2>/dev/null || true
546548 Type : NO_SOURCE
547549 TimeoutInMinutes : 30
548550 VpcConfig :
@@ -1362,7 +1364,7 @@ Resources:
13621364 - Ref : AWS::Region
13631365 - |-
13641366 "
1365- export TEMPLATE_TYPE="java-on-aws-immersion-day "
1367+ export TEMPLATE_TYPE="java-on-aws"
13661368 export ARCH="x86_64"
13671369 export IDE_TYPE="code-editor"
13681370 export WAIT_CONDITION_HANDLE_URL="
@@ -2008,14 +2010,15 @@ Resources:
20082010 Condition :
20092011 ForAllValues:StringEquals :
20102012 aws-marketplace:ProductId :
2011- - prod-jhuafngbly644
2013+ - prod-xdkflymybwmvi
20122014 - prod-mxcfnwvpd6kb4
2015+ - prod-jhuafngbly644
20132016 - prod-4pmewlybdftbs
20142017 " Null " :
20152018 aws-marketplace:ProductId : " false"
20162019 Effect : Allow
20172020 Resource : " *"
2018- Sid : MarketplaceSubscribeClaude45Opus45Sonnet4Sonnet
2021+ Sid : MarketplaceSubscribeClaude
20192022 - Action :
20202023 - acm:*
20212024 - apigateway:*
@@ -2031,6 +2034,8 @@ Resources:
20312034 - cloudwatch:*
20322035 - codewhisperer:*
20332036 - cognito-idp:*
2037+ - dbqms:*
2038+ - dynamodb:*
20342039 - ec2:*
20352040 - ecr:*
20362041 - ecs:*
@@ -2040,6 +2045,7 @@ Resources:
20402045 - lambda:*
20412046 - logs:*
20422047 - q:*
2048+ - rds-data:*
20432049 - rds:*
20442050 - s3:*
20452051 - s3vectors:*
@@ -2069,10 +2075,42 @@ Resources:
20692075 Sid : CreateServiceLinkedRole
20702076 - Action :
20712077 - iam:GetRole
2078+ - iam:ListAttachedRolePolicies
2079+ - iam:ListRolePolicies
20722080 - iam:ListRoles
20732081 Effect : Allow
20742082 Resource : " *"
20752083 Sid : GetRole
2084+ - Action :
2085+ - iam:AttachRolePolicy
2086+ - iam:CreateRole
2087+ - iam:DeleteRole
2088+ - iam:DeleteRolePolicy
2089+ - iam:DetachRolePolicy
2090+ - iam:PutRolePolicy
2091+ - iam:UpdateAssumeRolePolicy
2092+ Condition :
2093+ StringEquals :
2094+ iam:PermissionsBoundary : !Sub arn:aws:iam::${AWS::AccountId}:policy/workshop-boundary
2095+ Effect : Allow
2096+ Resource :
2097+ - !Sub arn:aws:iam::${AWS::AccountId}:role/aiagent*
2098+ - !Sub arn:aws:iam::${AWS::AccountId}:role/backoffice*
2099+ - !Sub arn:aws:iam::${AWS::AccountId}:role/mcp*
2100+ Sid : AiAgentCreateRoles
2101+ - Action : iam:PassRole
2102+ Condition :
2103+ StringEquals :
2104+ iam:PassedToService :
2105+ - bedrock.amazonaws.com
2106+ - bedrock-agentcore.amazonaws.com
2107+ - lambda.amazonaws.com
2108+ Effect : Allow
2109+ Resource :
2110+ - !Sub arn:aws:iam::${AWS::AccountId}:role/aiagent*
2111+ - !Sub arn:aws:iam::${AWS::AccountId}:role/backoffice*
2112+ - !Sub arn:aws:iam::${AWS::AccountId}:role/mcp*
2113+ Sid : AiAgentPassRole
20762114 - Action : ec2:RunInstances
20772115 Condition :
20782116 StringLike :
@@ -2116,6 +2154,48 @@ Resources:
21162154 Type : AWS::CloudFormation::WaitCondition
21172155 IdeWaitConditionHandleE8345861 :
21182156 Type : AWS::CloudFormation::WaitConditionHandle
2157+ IdeWorkshopBoundaryDEE72AD4 :
2158+ Properties :
2159+ Description : " "
2160+ ManagedPolicyName : workshop-boundary
2161+ Path : /
2162+ PolicyDocument :
2163+ Statement :
2164+ - Action :
2165+ - aws-marketplace:Subscribe
2166+ - aws-marketplace:Unsubscribe
2167+ - aws-marketplace:ViewSubscriptions
2168+ - bedrock-agentcore:*
2169+ - bedrock:*
2170+ - cloudfront:*
2171+ - cloudwatch:*
2172+ - cognito-idp:*
2173+ - dynamodb:*
2174+ - ec2:CreateNetworkInterface
2175+ - ec2:DeleteNetworkInterface
2176+ - ec2:DescribeNetworkInterfaces
2177+ - ec2:DescribeSecurityGroups
2178+ - ec2:DescribeSubnets
2179+ - ec2:DescribeVpcs
2180+ - ecr:*
2181+ - lambda:InvokeFunction
2182+ - logs:*
2183+ - s3:*
2184+ - s3vectors:*
2185+ - secretsmanager:GetSecretValue
2186+ - xray:*
2187+ Effect : Allow
2188+ Resource : " *"
2189+ Sid : AllowedServicesForRoles
2190+ - Action :
2191+ - account:*
2192+ - iam:*
2193+ - organizations:*
2194+ Effect : Deny
2195+ Resource : " *"
2196+ Sid : DenyIAM
2197+ Version : " 2012-10-17"
2198+ Type : AWS::IAM::ManagedPolicy
21192199 ThreadAnalysisLambda3EE9B29D :
21202200 DependsOn :
21212201 - ThreadAnalysisLambdaRoleDefaultPolicyC7AD40BA
@@ -3110,7 +3190,7 @@ Resources:
31103190 - Ref : AWS::AccountId
31113191 - " -"
31123192 - Ref : AWS::Region
3113- - " -20260119085223 "
3193+ - " -20260324173337 "
31143194 PublicAccessBlockConfiguration :
31153195 BlockPublicAcls : true
31163196 BlockPublicPolicy : true
0 commit comments